introduce a single shared stylesheet under public/css. this first
section covers a minimal reset, warm/readable design tokens (color,
typography, spacing, radii, shadows), and base element styling for
headings, links, lists, forms, and buttons. layout primitives and
component classes follow in subsequent commits.
Forcing every call site to be explicit eliminates a class of bugs where an unintended default silently slips through. Codifies the convention already established by prior commits (cd40483, b41652a, 8eb0f23).
Forcing every call site to be explicit about admin status and
password eliminates a class of bugs where an unintended
isAdmin=false or empty passwordHash could silently slip through.
The CreateUserTest case that asserted the isAdmin default is
dropped since the default no longer exists.
Replace the strict "one commit per file" guidance with grouping by
related changes, while keeping the small-and-focused intent. Add
explicit guidance on when to include a commit body and how to format
it (blank line separator, ~72 col wrap).
Applied to both backend and frontend prompt templates.
Add a trivial prefix-based PasswordHasher fake and inject it into the
three test files that exercise CreateUser or AuthenticateUser. Drops
the full phpunit suite from ~7.4s to ~30ms (about 224x) without
losing coverage: the round-trip through hash/verify still validates
that CreateUser stores something other than the plaintext and that
AuthenticateUser only succeeds on a matching hash.
CreateUserTest is also refactored to use a setUp method, matching
the pattern already used in AuthenticateUserTest and AuthControllerTest.
